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Abstract 

How hard is it to invert NP-problems? We show that all superlinearly certified 
inverses of NP problems are coNP-hard. To do so, we develop a novel proof technique 
that builds diagonalizations against certificates directly into a circuit. 

1 Introduction 

In this paper we show that all superlinear inverse schemes of NP problems are coNP- 
hard. We develop a novel proof technique that allows us to diagonalize against all possible 
certificate sets. We feel that this "in-circuit diagonalization" proof technique is of interest 
in its own right. 

The class NP can be viewed as the set of all languages L such that there exist a 
polynomial-time computable verifier V and a polynomial q such that, for all x £ £*, 
x E L (By E = q(\x\) AV(x,y) accepts]. A string y such that V(x,y) 

accepts is called a certificate or proof for x. Verifiers can formally be defined as follows (see 
Definition 

A pair (V, q) is called a standard verifier if and only if 

1. V : X* x X* — > {0, 1} is a polynomial-time computable mapping, and 
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2. q : N — > N is a strictly monotonic, integer-coefficient polynomial such that 
(Vx,yeZ*)[V(x,y) = l =► |y| = g(|z|)]. 

Inverting standard verification schemes can now informally be described as follows: Let 
(V, q) be a standard verifier. Given a set C of certificates, does there exist a string x such 
that C is exactly the set of certificates for x (relative to (V, q))l It is quite natural to choose 
a succinct representation of certificates, namely, in the form of a circuit. This leads to the 
following definition (see Definition 12.5(1 of the inverse problem, which basically asks if a set 
of strings specified by a circuit is such that some string has precisely those strings as its 
certificate set. 

Let (V, q) be a standard verifier. 

Invsy i9 = {c | c encodes a circuit d having q(m) inputs for some m G N such 
that (3x € Z m )[{w G S<?( m ) | V{x,w) = 1} = {y G S"( m ) | d(y) = 1}]}. 

We show that inversion for all superlinear standard verification schemes is coNP-hard. 
In fact we show even more, namely, that inverting any standard verification scheme (V, q) 
where q grows faster than all outright linear functions n + k, k G N, is coNP-hard (see 
Theorem 13. 2[) , So coNP-hardness in fact holds for all Invsyq where (V,q) is a standard 
verification scheme and q is a polynomial of degree either greater than one or of degree one 
with a degree-one-coefficient a\ > 1. 

The proof of our main result is based on a proof technique that can informally be 
described as an "in-circuit diagonalization" against possible certificate sets. In particular, 
our in-circuit diagonalization technique uses a circuit to diagonalize against certificate sets 
that are potentially accepted by the very same circuit. The need to diagonalize in such an 
unusual way arises from the fact that when reducing SAT to Invsy g (as we will do in the 
proof of Theorem 13 .2 J) one has to map boolean formulas to circuits such that the following 
holds: If the formula is satisfiable then, for all x, the set of strings accepted by the circuit 
is not equal to the set of certificates for x (relative to (V, q)); and if the formula is not 
satisfiable then there exists a string x such that the the set of strings accepted by the 
circuit is exactly the set of certificates for x (relative to (V,q)). 

Relatedly, is clearly an upper bound for the complexity of inverting standard verifi- 
cation schemes, and we prove that this upper bound is optimal by constructing a standard 
verifier such that its inversion problem is S^-complete (see Theorem 13. 7|) . Our actual con- 
struction in fact ensures that there exist a P set A and a standard verifier (V, q) for A such 
that Invsy i9 is S^-complete. 

Our results can be extended to also hold for the one-sided variant of inversion of ver- 
ification schemes, 1-Invsy ? . The difference in the definitions of Invsy g and 1-Invsy ? (see 
Definition 12 .5j) is that instead of requiring "3x G X* such that the set of strings accepted by 
the circuit equals the set of certificates of x" as in definition of Invsy g , we in the definition 
of 1-Invsyq require a 3x G L(V, q) such that the set of strings accepted by the circuit equals 
the set of certificates of x." 
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In a fascinating paper by Chen |Che03| . a type of inversion of NP problems is studied 
that is somewhat related to the above-described one-sided-inversion problem, 1-Invsy )(? , 
and ElJ results are obtained. However, the models are different; for example, in contrast to 
our definition, where certificates are given in a very succinct form, i.e., implicitly in form 
of a circuit, Chen studied one-sided inversions of NP problems where the certificates are 
explicitly given, i.e., in form of a set or a list and, as mentioned above, Chen's focus is on 
the one-sided inversion problem. 

Our paper is organized as follows. After formally defining the basic concepts in Section^ 
in Section 01 we state and prove our main result — that all superlinearly certified inverses 
are coNP-hard. In Section |3] we also prove a number of related theorems, in particular 
the optimality of the E^ upper complexity bound for Invsy.g- In Section |1J we turn to 
the complexity of recognizing whether machines compute verifiers and we establish T,®- 
completeness results on this. 

2 Preliminaries 

We assume the reader to be familiar with the basic definitions and concepts of complexity 
theory (see |Pap94| Iffll02] V Let S = {0,1} be our alphabet. N denotes {0,1,2,...} and 
Z denotes {. . . , —3, —2, —1, 0, 1, 2, 3, . . .}. We say a polynomial p is strictly monotonic (by 
which we always mean strictly monotonically increasing) if, for all n € N, p(n + 1) > p(n). 
For any set A and any m € N, A =m denotes {z \ z € A A \z\ = m}. 

Without defining it formally we will make use of a nice (i.e., polynomial-time computable 
and polynomial-time invertible) encoding of any boolean circuit (consisting of AND, OR 
and NOT gates) as a word over the alphabet E. As is standard, we denote the outcome (0 
or 1, representing reject/false and accept/true) of a circuit c on input x by c(x). 

Let FP denote the set of all (total) polynomial-time computable functions, where these 
functions can be of arbitrary finite arities. We will use the following standard complexity 
classes. 

Definition 2.1 1. P is the set of all languages that can be accepted in deterministic 
polynomial time. 

2. NP is the set of all languages that can be accepted in nondeterministic polynomial 
time. coNP is defined to be the set of all languages A such that A E NP. 

3. JPY84I DP is the set of all languages L such that there exist NP sets A and B 
satisfying L = A — B . 

4- IMS72\ \Sto70j is the set of all languages that can be accepted by nondeterministic 
polynomial-time Turing machines with the help of an NP oracle: Ef = NP NP . PH 
denotes the polynomial hierarchy: PH = P U NP U NP NP U NP NpNP U • • • . 
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We mention in passing that P, NP, and DP are the low levels of the boolean hier- 
archy |CGH+88l ICGH+89| and that P, NP, and are the low levels of the polynomial 
hierarchy |MS721 !5to76j . 

Let REC denote the set of all recursive languages. The second level of the arithmetic 
hierarchy is defined as follows. 

Definition 2.2 (see \Rog 61 1 ) A language L is in X!] if an d on ^V if there exists a language 
B G REC such that for all x G X*, 

x G L (3ye X*)(Vz G Z*)[(x,y,z) G B], 

where (-,-,•) here is a standard, nice 3-ary pairing function. 

As is standard we will use < m (respectively, <m ) to denote recursive many-one reduc- 
tions (respectively, polynomial-time many-one reductions) between languages. 

In the following we will define the basic concepts that allow us to study inverse NP 
problems. 

Definition 2.3 1. A pair (V,q) is called a standard verifier if and only if 

(a) V : X* x X* — > {0,1} is a polynomial-time computable mapping, and 

(b) q : N — > N is a strictly monotonic, integer- coefficient polynomial such that 

(Vx,yeZ*)[V(x,y) = l \y\ = q(\x\)]. 

2. We say that (V, q) is a standard verifier for a language L if and only if (V, q) is a 
standard verifier and L = L(V,q), where L(V,q) = {x £ S* | (By G = 
q{\x\) A V{x,y) = 1]} (equivalently, L(V,q) = {x G £* | (3y G E*)[V(x,y) = I}}). 

3. We say a 2-ary Turing machine M computes a standard verifier if there are a poly- 
nomial r and a polynomial q such that 

(a) M runs in r-bounded time (by which we mean that for each x,y G T,* , M(x,y) 
halts in at most r(\x\ + \y\) steps), and 

(b) q : N — > N is a strictly monotonic, integer- coefficient polynomial such that 

( Vx, y G Z*)[xL(M)(x,y) = 1 q(\y\) = \x\]. 

(Note: Regarding types, L(M) C S* x S* ; and XL(M) — the characteristic 
function — maps from X* x X* to {0, 1}.) 

The following two facts are immediate and standard. 

Fact 2.4 1. For every set A G NP there exists a standard verifier (V,q) such that (V,q) 
is a standard verifier for A. 
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2. If (V, q) is a standard verifier for a language L then L G NP. 
We now define the inverse problem for NP languages. 
Definition 2.5 Let A G NP and let (V,q) be a standard verifier for A. 

1. Invsv, g = {c I c encodes a circuit d having q(m) inputs for some m G N such that 
(3x G S m ) [{w G X"( m ) | V{x,w) = 1} = {y G S^ m ) | c'{y) = 1}]}. 

1-Invs^q = {c I c encodes a circuit d having q(m) inputs for some m G N stic/i that 
(3x G ^ =m )[{w G S«( m ) | K(x,u;) = 1} = {y G | c'(y) = 1}]}. 

It is not hard to see that for standard verifiers (V,q), Invsy,<j and 1-Invsy^ are always 
in T<2- However, Invsv, g and l-Invs\/ g seem to differ with respect to their complexity lower 
bounds. 

Proposition 2.6 There is a set A £ NP such that for all standard verifiers (V, q) for A, 
l-lnvsv, q G P. 

One proof is by simply choosing A to be or any other finite set. In contrast, for every 
standard verifier (V, q) for we have that Invsy^ is <? m -complete for coNP. 

Proposition 2.7 Let (V,q) be a standard verifier for 0. Then Invsy i(? is < p m -complete for 
coNP. 

The claim follows from the fact that from (V, q) being a standard verifier for the set 
Invsy j(? is essentially the set of all appropriate-number-of-inputs circuits that for no input 
evaluate to 1, and is easily seen to be in coNP. Also, it is straightforward to reduce the 
coNP-complete language SAT to Invsy^. 

3 Inverting NP Problems is coNP-complete 

Before stating our main theorem we need a technical definition. 

Definition 3.1 A polynomial q is called miserly if and only if for all e > there exist 
infinitely many n G N such that q(n) < (1 + d)n. 

Note that for strictly monotonic polynomials p, p(n) = a^n k + aj t -in k " 1 + • • • + ain + ao, 
with a& > 0, we have that p is nonmiserly if and only if either (a) k > 2 or (b) k = 1 and 
ai > 1. 

Theorem 3.2 Let A G NP and (V, q) be a standard verifier for A such that q is a non- 
miserly polynomial. Then Invsy^ is <m -hard for coNP. 
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This immediately yields the following, where by "nonmiserly standard verifier" we mean 
a standard verifier whose second component is a nonmiserly polynomial. 

Corollary 3.3 No nonmiserly standard verifier for an NP set has an inverse problem be- 
longing to NP ; unless NP = coNP. 

Proof of Theorem 13.21 Let A G NP and let (V, q) be a standard verifier for A. Suppose 
that q is nonmiserly. We will show that SAT <m Invsy i(J . 

Let F be a formula and suppose that F has n variables. Our reduction g will map F 
to the encoding c = g(F) of a circuit c' . The circuit c' will have q(n') inputs where n' 
is the smallest natural number such that q(n') > n + n'. Note that since q is nonmiserly 
n' is linearly related to n and can be found in polynomial time. On input z G {0, l} q ( n '\ 
let x, a, and r be the unique strings such that z = xar, x G {0, l} n , a G {0, l} n , and 
r G {0, l} 9 ( n )~ n ~ n . The circuit c' consists of three subcircuits that work as follows: 

Subcircuit 1: Subcircuit 1 simulates the work of V(x,z). Let a = V(x,z) be the output 
of subcircuit 1. 

Subcircuit 2: Subcircuit 2 is a polynomial-size-bounded circuit for F with a as its input. 
Let b = F{a) be the output of subcircuit 2. 

Subcircuit 3: Subcircuit 3 simulates the work of V(0 n ' , z) . Let d = V(0 n ' , z) be the output 
of subcircuit 3. 

Output of c': d outputs Oifb = d = 0ora = b=l. d outputs 1 otherwise, that is if 
either a) b = and d = 1 or b) b = 1 and a = 0. 

It is obvious that d and thus also c can be constructed in time polynomial in \F\. 

It remains to show that for all formulas F, F G SAT -4=4> fl^i* 1 ) G Invsy q . Suppose 
that F G SAT. So we have for all inputs z to the circuit d, 6 = 0. Thus, for all inputs 
z, c'{z) = 1 if and only if d = 1. By construction d = 1 if and only if y(0 n , z) = 1. 
It follows that {z G S^"') | d{z) = 1} = {y G S^ n ') | T/(0 n ',y) = 1} and so (via 
the certificates of n ) c = g(F) G Invsy j? . For the other direction of the equivalence 
to be shown assume F ^ SAT. So there exists an n-bit assignment a for F such that 
F(a) = 1 and consequently for all inputs z to the circuit d such that z = xar with 
x G {0, 1}™' and r G {0, l}9(»'W-» we have b = 1. It follows that for all x G {0, l} n ' there 
exists some input z 1 to the circuit, namely z 1 = xa0 q ( n • > ~ n ~ n , such that (a) c'(z') = if 
a = V(x, z') = 1 and (b) d(z') = 1 if a = V(x, z') = 0. It follows that for all x G {0, 1}"', 
{z G | d(z) = l}^{ye | V(x,y) = 1}, and so g(F) $ Invsy i(? . □ 

Since by our remark preceding Theorem 13.21 anv superlinear polynomial is nonmiserly, 
we have the following corollary. 

Corollary 3.4 Let A G NP and let (V, q) be a standard verifier for A such that q is a 
superlinear polynomial. Then Invsy l(? is <m -hard for coNP . 
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Before we can state a similar result for 1-Invsy g , we need a technical concept. Though 
as far as we know it is a new concept, we feel it is also a very natural concept. We will call 
this notion P-producibility. (In choosing the nomenclature, we are motivated by the term 
and notion of "self-P-producible circuits" [Ko85l IBB861 IOW93| .l 

Definition 3.5 We say a set A is P-producible if and only if there exists a function h G FP, 
h : S* — > £*, such that for all x G £*, \h(x)\ > \x\ and h(x) 6 A. 

Our definition of P-producibility should be contrasted (especially as to what the polynomial 
time is in relation to — the input or the output) with the notion of tangibility introduced 
by Hemachandra and Rudich: A set A is called tangible if and only if there exists a total 
function / that can be computed in time polynomial in the size of its output such that for 
all x G £*, f(x) G A and f(x) >i ex i CO gra P hicai x |HR90j. 

Theorem 3.6 Let A be any NP set that is P-producible. Let (V,q) be a standard verifier 
for A such that q is a nonmiserly polynomial. Then 1-Invsy^ is <m -hard for coNP. 

Proof: Let A be an NP set that is P-producible via a function h G FP, h : E* — > £*. Let 
(V, q) be a standard verifier for A such that q is a nonmiserly polynomial. 

The proof proceeds quite similarly to the proof of Theorem l3.2l Let F be a formula with 
n variables. Let n' be the smallest natural number such that q(n') > n + n' . The difference 
from the proof of Theorem E21 is that the constructed circuit c' has to be modified as follows: 
Let w = h(0 n c' will have q(\w |) inputs. On input z G {0, lJ-^dH^ l e t z = xar where 
x G {0,1}\ W \, a G {0, l} n , and r G {0, 1}9(M)-M-* the circuit works as follows (note the 
natural adjustment in Subcircuit 3). 

Subcircuit 1: Subcircuit 1 simulates the work of V(x,z). Let a = V(x,z) be the output 
of subcircuit 1. 

Subcircuit 2: Subcircuit 2 is a polynomial-size-bounded circuit for F and uses a as its 
input. Let b = F(a) be the output of subcircuit 2. 

Subcircuit 3: Subcircuit 3 simulates the work of V(w, z). Let d = V(w, z) be the output 
of subcircuit 3. 

Output of c': c' outputs 0i£b = d = 0ora = b=l. d outputs 1 otherwise, that is if 
either a) b = and d = 1 or b) b = 1 and a = 0. 

The correctness of the reduction can be shown as in the proof of Theorem 13. 21 where w 
now plays the role that n played in the proof of Theorem 13.21 □ 

In the reminder of this section we will establish some S^-completeness results and a 
result about membership in DP. 

As already mentioned in Section [21 Invsy.g G X?? for all standard verifiers (V,q). We will 
now show that this upper complexity bound is optimal. 
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Theorem 3.7 There exists a standard verifier (V, q) such that Invsy j(? is Yf 2 - complete. 

Proof: Since Invsy^ G for all standard verifiers (V,q), it suffices to show that there 
exists a standard verifier (V, q) such that Invsy, g is Sg-hard. 
Consider the language 3V3SAT, 

3V3SAT = {F | F is a boolean formula in 3-DNF having 2n variables 
x±,X2, ■ ■ ■ , x n and 2/1,2/2, • • • > Un for some n G N and 
(3a G {0, l} n )(V/3 G {0, l} n )[F(a,/3) = 1]}, 

where -F(a, /?) denotes the truth value of F when using a and (3 as assignments for the 
variables x\, X2, ■ ■ ■ , x n and yi,V2, ■ ■ ■ ,Un, respectively. 

3V3SAT is known to be E^-complete |Wra76j . Let encode be a polynomial-time 
computable and polynomial-time invertible encoding function for boolean formulas in 3- 
DNF. Let double be a mapping from {0, 1}* to {0, 1}* such that for all k G N and all 
0,1,0,2, G {0, 1}, double{a\a2 ■ ■ ■ Ofc) = a\a\a2a2 ■ ■ ■ afcafc- 

Let q(n) = n for all n G N. We define the following verifier (V, q): 

V accepts on input (u, v) if and only if there exist a natural number n, a 
boolean formula F in 3-DNF with 2n variables x±, X2, ■ ■ ■ , x n ,yi, y%, . . . ,y n , 
and strings a, (3 G {0, l} n such that u = encode(F)01double(a) and v = 
encode(F)01double((5) and F(a,(3) = 1. 

It is not hard to see that (V, q) is a standard verifier. 

To show that 3V3SAT <m Invsy^ we will map formulas F having the required syntac- 
tic properties (3-DNF, even number of variables) to the encoding cp of a circuit — having 
\encode{F)\ + 2n + 2 inputs — that accepts all strings of the form encode(F)0ldouble((3) for 
any /? G {0, l} n and rejects all other strings. All other formulas, i.e., those formulas not in 
3-DNF or having an odd number of variables, are mapped to the encoding c of a circuit that 
accepts exactly one string, namely (this ensures that if F does not have the the required 
syntactic properties and thus F ^ 3V3SAT, then c ^ Invsy )9 ). The described reduction is 
clearly polynomial-time computable. 

It remains to show that for all formulas F having the above-mentioned syntactic prop- 
erties (3-DNF, even number of variables) it holds that F G 3V3SAT <^=^ cf G Invsy,g. Let 
F G 3V3SAT. It follows that there exists a partial assignment a G {0, l} n such that for all 
partial assignments G {0, l} n , F(a,/3) = 1. Hence there exists u = encode(F)01double(a) 
such that for all v = encode(F)01double((3) , V(u, v) = 1. By construction of cf we thus 
have cf G Invsy j(? . For the other implication assume F ^ 3V3SAT. Hence for all a G {0, l} n 
there exists (5 G {0, l} n such that F(a, f3) = 0. It follows from the definition of V that for all 
u = encode(F)01double(a) there exists v = encode(F)0ldouble(f3) such that V(u, v) = 0. 
By construction of cj? we thus have cf ^ Invsy i? . 

This completes the proof. □ 
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Note that the verifier V defined in the proof of Theorem 13. 71 is a verifier for the language 
L of all strings w such that there exist a natural number n, a boolean formula F in 3-DNF 
with 2n variables x%, x 2 , ■ ■ ■ , x n , y\, y 2 , ■ ■ ■ , y n , and a string a £ {0, l} n such that 

w = encode(F)Oldouble(a) A (3/3 e {0, l} n )[F(a, /3) = 1]. 

It is not hard to see that L E P since satisfiability for 3-DNF formulas can be checked in 
polynomial time. 

Corollary 3.8 There exist a language LgP and a standard verifier (V, q) for L such that 
Invsy, q is S|- complete. 

In fact, looking carefully at the construction in the proof of Theorem 13. 7| we see that 
the just-given proof also establishes the following one-sided result. 

Corollary (to the proof) 3.9 There exist a language L E P and a standard verifier (V, q) 
for L such that 1-Invsy j(? is T^- complete. 

So even simple sets can have very hard inverse problems (Corollaries 13.81 and I3.9|) . 
Nonetheless, all (NP) sets have at least one standard verifier whose one-sided inverse prob- 
lem is not too hard, namely, it belongs to DP (note: if DP = then PH collapses to 
DP). 

Theorem 3.10 Every set A E NP has a standard verifier (V,q) such that 1-Invsy,g E DP. 

Proof: Let A E NP and let (R,p) be a standard verifier for A. Let q(n) = n + p(n) and 
define a verifier V as follows: 

V accepts on input (a, b) if and only if there exists a string b' such that b = ab' 
and R(a,b') = 1. 

It is not hard to see that (V, q) is a standard verifier for A. 
By definition we have 

l-Invsy )(J = {c I c encodes a circuit c' having q(m) inputs for some m E N 
such that (3x E A= m )[{w E j V(x,w) = 1} = {y E 

£9M j d{y) = 1}]}. 

This can be rewritten, keeping in mind the particular V we have defined, as follows. 
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1-Invsy^ = {c | c encodes a circuit d having q(m) inputs for some m G N 
such that: 

(V«,v G S«( m ))[if c'(u) = c» = 1 then the first m bits 

of u and u are identical] 

and 

(Vit,u G S9( m ))(Vx G S m )[if d(u) = 1 and c» = and 
u = xv! and u = xv' then i?(x, u') = 1 and R(x, v') = 0] 
and 

(Vu G S«( m ))(Vx G S m )[if c'(u) = 1 and u = zu' 

then then R(x, v!) = 1] 

and 

(3v G £^ m ))[c» = 1]}. 

This rewritten version (keeping in mind that the quantification over m is not a "real" 
quantifier) makes it clear that 1-Invsy i9 G DP, as it is of the form A n B n C n D, with 
A,B,C G coNP and D G NP, and so is of the form of the difference of two NP sets, namely, 

D - (AnBnC). □ 
4 The Complexity of Recognizing Verifiers 

In this section we show that deciding whether a given machine computes a standard verifier 
is complete for the second level of the arithmetic hierarchy, S^. Before doing so, we introduce 
the notion of a "general verifier," in which the "hit the length exactly" restriction on the 
certificate size is changed to just a one-sided bound, and we prove a X^-completeness result 
for that. We do so primarily since the proof for that case is clearer and so helps introduce 
the related but more involved S2" com Pl e t eness proof for the case of standard verifiers. 

Definition 4.1 1. A pair (R,q) is called a general verifier if and only if 

(a) R : S* x S* — > {0, 1} is a polynomial-time computable mapping, and 

(b) q : N — > N is a strictly monotonic polynomial such that 

(Vx, y G E*)[R(x,y) = 1 q{\y\) > \x\\. 

2. We say a 2-ary Turing machine M computes a general verifier if there are a polynomial 
r and a polynomial q such that 

(a) M runs in r-bounded time (by which we mean that for each x,y G £*, M(x,y) 
halts in at most r(|x| + \y\) steps), and 

(b) q : N — > N is a strictly monotonic polynomial such that 

(Vx,?/ g z*)[x L (M)(x,y) = i =>- q{\y\) > kl]- 

(Note: Regarding types, L(M) C S* x S* ; and Xl(m) — ^ e characteristic 
function — maps from S* x S* to {0, 1}J 
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Let M±, M2, M3, ... be a standard enumeration of deterministic 2-ary Turing machines. 

Theorem 4.2 The index set I ve r,gen = {2 G N | Mi computes a general verifier} is < m - 
complete for E^. 

Proof: It is not hard to see that I ver ,gen G Er) sm ce I ver ,gen can be described as follows: 

i> G Iver,gen '•• '* 

(3k G N)(Va;,y G E*)[Mj(a;,y) halts within at most (\x\ + |y|) fc + k steps and if 
Mi(x,y) accepts within at most (|x| + \y\) k + k steps then \y\ k + k > \x\]. 

(To see this, note that given a machine Mi as well as the polynomial q and the strictly 
monotonic polynomial r that with respect to M; fulfill part [21 of Definition 14.11 we will 
choose to use a fc so large that (Vn G N)[n fc + k > max(g(n), r(n))].) Note that the right 
hand side of the above " " shows membership in 

It remains to show that I ver ,gen is < m -hard for Eg. Since I finite = {i \ L(Ni) is finite} 
(where Ni, N%, -ZV3, . . . is a fixed standard enumeration of Turing machines, e.g., that of 
Hopcroft-Ullman |HU79j ) is < m -hard (even < m -complete) for Eg it suffices to show that 
1 finite <m I-uer, gen- Given (as input to our reduction) any i £ N, by the nice properties 
of the standard enumeration, we can effectively construct from % a machine E that is an 
enumerator for L(Nj). We now describe a Turing machine M. M is a 2-ary Turing machine 
that on input (x, y) G E* x E* does the following steps: 

1. Simulate \x\ + \y\ steps of the work of E and let A be the set of all strings that are 
enumerated by E within those |x| + \y\ steps. 

2. Simulate 2(\x\ + |y|) steps of the work of E and let B be the set of all strings that are 
enumerated by E within those 2(|x| + \y\) steps. 

3. Accept (i.e., output true) if B — A ^ 0; otherwise reject (i.e., output false). 

Clearly, M is a 2-ary Turing machine. Let j be an index such that Mj = M (we assume our 
standard enumeration is expansive enough to include all the obviously 2-ary, deterministic 
machines created by this construction — this is a legal assumption) . Since j clearly depends 
only on i we have implicitly described a mapping / : N — ► N. Note that / is computable. 
It suffices to show that for all i G N, i G I finite /(*) G Ivergen- Let i £ N and let 

j = m- 

Case 1: i G Ifinite- So L{Ni) is finite and the number of strings enumerated by E 
is finite as well. Note that since Mj by definition runs in polynomial time and since E 
enumerates only a finite number of strings it follows from the construction of Mj that Mj 
accepts only a finite number of inputs and thus it holds that there exists a strictly monotonic 
(integer-coefficient) polynomial p such that for all x,y G E*, if Mj(x,y) outputs true then 
p(|y|) ^ \ x \- So (remembering also the polynomial-time claim made above) Mj computes a 
general verifier and thus j G Ivergen- 
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Case 2: i 4 

I finite- In this case, E enumerates an infinite number of strings and thus 
for all y G E*, Mj(x, y) outputs true for infinitely many x G E*. So there does not exist a 
(strictly monotonic) polynomial p such that, for all x, y G E*, if Mj(x, y) outputs true then 
p(\y\) > \x\. Thus, Mj does not compute a general verifier and so j ^ I V er,gen- Q 

Does the same classification hold for standard verifiers? Note that the "hit the length on 
the head"-ness of standard verifiers will be something of a technical obstacle. Nonetheless, 
by carefully choosing the pairs (x, y) that are accepted by the constructed machine we are 
able to show that deciding whether a given machine computes a standard verifier is also 
complete for E^- 

Theorem 4.3 The index set I ve r,std = {i € N | Mj computes a standard verifier} is 
< m - complete for E°- 

Proof: It is not hard to see that I ver ,std G E° since I ve r,std can be described as follows: 

* ^ ^ver,std '* 

(3k G N)(3£ G K)(3a ,a 1 ,a 2 ,...at G Z)(Vx,y G E*)(Vra G N)[(Mi(x,y) halts 
within at most (|x| + |y|) fe + fc steps and if M{(x,y) accepts within at most 
(\x \ + \y\) k + k steps then \y\ = a^xf + a£-\\x\ e ~ 1 + • • • +ai|x| +«o]) and (a£n e + 
a^_in^ _1 H h axn + a < a f (n + 1)^ + a£_i(n + H h ai(n + 1) + a )]. 

Note that the right hand side of the above " <^=^» " shows membership in E!]. 

It remains to show that I V er,std is < m -hard for E^. As in the proof of Theorem 14.21 it 

Suffices to Show that I finite <m Iver,std- 

Before we describe the reduction we need a few technical definitions. We define a family 
of polynomials as follows: 

q (n) = n + 1, 
and, for each i G {1, 2, 3, . . .}, we inductively define 

= n(n - l)(n - 2) . . . (n - i) + qi(n). 

Note that, for all i G N, (a) i! < <fr(i) and (b) % is a strictly monotonic, integer-coefficient 
polynomial. Observe that the polynomials qi and the numbers mj satisfy the following: 

1 = <Zo(0) = 9i (0) = (6(0) = g 3 (0) = 94(0) = 95(0) = ... 
3 = 9i(l) = 92(1) = 93(1) = 94(1) = 95(1) = ... 

7 = 92(2) = 93(2) = 94(2) = 95(2) = ... 

mi = 9j(i) = q i+ i{i) = 9i+2 00 = ••• 



We return to showing that I finite <m Iver,std- So, suppose that we are given any i G N 
(and we wish to effectively compute a string f(i) such that i G I finite /(£) G I ve r,std)- 

By the nice properties of the standard enumeration, we can effectively construct from i a 
machine E that is an enumerator for L(iVj). We now describe a Turing machine M. M is 
a 2-ary Turing machine that on input (x, y) G E* x E* does the following steps: 
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1. If \y\ 7^ q\ x \(\x\) halt and reject the input (i.e., output false). If \y\ = q\ x \(\x\) continue. 

2. Simulate \x\ + \y\ steps of the work of E and let A be the set of all strings that are 
enumerated by E within those |x| + \y\ steps. 

3. Simulate (|x| + \y\) 2 steps of the work of E and let B be the set of all strings that are 
enumerated by E within those (\x\ + \y\) 2 steps. 1 

4. Accept (i.e., output true) if B — A ^ 0; otherwise reject (i.e., output false). 

Clearly, M is a 2-ary Turing machine. Let j be an index such that Mj = M (we assume our 
standard enumeration is expansive enough to include all the obviously 2-ary, deterministic 
machines created by this construction — this is a legal assumption) . Since j clearly depends 
only on i we have implicitly described a mapping / : N — ► N. Note that / is computable. 
It suffices to show that for all i £ N, i £ I finite *^=> f{i) £ Iverstd- Let i £ N and let 

i = /(»")• _ ^ 

Case 1: i £ Ifinite- So L(iVj) is finite and the number of strings enumerated by E 
is finite as well. Note that since Mj by definition runs in polynomial time and since E 
enumerates only a finite number of strings it follows from the construction of Mj that Mj 
accepts only a finite number of inputs. So it holds that there exists a strictly monotonic 
(integer-coefficient) polynomial p such that for all x,y £ £*, if Mj(x,y) outputs true then 
p(|x|) = \y\. In particular, by our definition of the polynomials % (and remembering also the 
polynomial-time claim made above) we have that if n £ N is the largest number such that 
a pair (x,y), \x\ = n, is accepted by Mj then (\y\ = q n (n) and) Mj computes a standard 
verifier (with working as the "g" of Part |3] of Definition I2.3|) . 

Case 2: i 4 

^finite- In this case, E enumerates an infinite number of strings. We will 
argue that then Mj accepts an infinite number of pairs and thus there does not exist a 
polynomial p such that for all pairs (x,y) £ L(Ma) we have \y\ = p{\x\). Note that the 
Turing machine Mj described above accepts only pairs (x,y) where \y \ = qi x i(\x\) and thus 
one might worry that even though E enumerates an infinite set, Mj only accepts finitely 
many pairs. Indeed, observe that if we had (as in the proof of Theorem 14.2(1 chosen the 
number of steps E is simulated in steps 2 and 3 of the description of Mj to be, respectively, 
\x\ + \y\ and 2(\x\ + |y|), we would have left coverage "gaps," and it might happen that even 
though E enumerates an infinite set, Mj would be "triggered" to accept pairs only a finite 
number of times. However, by choosing the number of steps the enumerator E is simulated 
by Mj to be \x\ + \y\ and (\x\ + \y\) 2 in, respectively, steps 2 and 3, it follows 2 that if E 
enumerates an infinite set then Mj accepts infinitely many pairs. So M,(0 n ,0 9 "( n )), when 

lr The reason that we use the bound (|a^| + |j/|) 2 , rather than 2(|x| + |j/|) as we did in the proof of Theorem l4.2l 
will be explained later in this proof. 

2 Keeping in mind that the only interesting case is when the second argument's length, call it £2, is related 
to the first argument's length, call it £i, by the equation i% = what we need to show to ensure that 

there are only finitely many gaps in coverage is that for all but at most a finite number of n's (and only 
focusing in this footnote on second arguments y of the length-relation just mentioned) the simulation-step 
bound in Step 3 when \x\ = n is greater than the simulation-step bound in Step 2 when \x\ = n + 1. 
That is, we need it to hold that, for all sufficiently large n £ N, (n + q n (n)) 2 > (n + 1) + q n +i(n + 1). 



13 



i I finitei outputs true for infinitely many n € N. Recall that by definition we have that for 
all n £ N, n! < q n (n). So there does not exist a polynomial p (whether strictly monotonic 
or otherwise) such that, for all x,y € £*, if Mj(x,y) outputs true then = \y\. Thus, 

Mj does not compute a standard verifier, and so j ^ I ver ,std- Q 



5 Conclusions 

We have shown that all super linear inversion schemes are coNP-hard. We have also shown 
that some inversion schemes are X^-complete. Note that for finite sets A and any of their 
standard verifiers (V, q) we have that Invsy, g is coNP-complete. It is not clear whether the 
complexity of inverting standard verifiers for infinite NP sets is also independent of the 
verifier. In particular, does every infinite NP set have a standard verifier (V, q) such that 
Invsy i( j is E^-complete? 
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